CVE-2021-36839 - Vulnerability Details - OpenCVE

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Spacexchimp	Social Media Follow Buttons Bar

Configuration 1 [-]

cpe:2.3:a:spacexchimp:social_media_follow_buttons_bar:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
https://wordpress.org/plugins/social-media-buttons-toolbar/

History

No history.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2022-09-30T16:14:55.217259Z

Updated: 2024-09-16T20:51:45.032Z

Reserved: 2021-07-19T00:00:00

Link: CVE-2021-36839

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-09-30T17:15:11.423

Modified: 2024-11-21T06:14:10.440

Link: CVE-2021-36839

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Social Media Follow Buttons Bar (WordPress plugin)", "vendor": "Space X-Chimp", "versions": [{"lessThanOrEqual": "4.73", "status": "affected", "version": "<= 4.73", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Vulnerability discovered by Asif Nawaz Minhas (Patchstack Alliance)"}], "datePublic": "2022-09-26T00:00:00", "descriptions": [{"lang": "en", "value": "Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-30T16:14:55", "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://wordpress.org/plugins/social-media-buttons-toolbar/"}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Social Media Follow Buttons Bar plugin <= 4.73 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2022-09-26T16:09:00.000Z", "ID": "CVE-2021-36839", "STATE": "PUBLIC", "TITLE": "WordPress Social Media Follow Buttons Bar plugin <= 4.73 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Social Media Follow Buttons Bar (WordPress plugin)", "version": {"version_data": [{"version_affected": "<=", "version_name": "<= 4.73", "version_value": "4.73"}]}}]}, "vendor_name": "Space X-Chimp"}]}}, "credit": [{"lang": "eng", "value": "Vulnerability discovered by Asif Nawaz Minhas (Patchstack Alliance)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve", "refsource": "CONFIRM", "url": "https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"}, {"name": "https://wordpress.org/plugins/social-media-buttons-toolbar/", "refsource": "CONFIRM", "url": "https://wordpress.org/plugins/social-media-buttons-toolbar/"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:01:59.770Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wordpress.org/plugins/social-media-buttons-toolbar/"}]}]}, "cveMetadata": {"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "assignerShortName": "Patchstack", "cveId": "CVE-2021-36839", "datePublished": "2022-09-30T16:14:55.217259Z", "dateReserved": "2021-07-19T00:00:00", "dateUpdated": "2024-09-16T20:51:45.032Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:spacexchimp:social_media_follow_buttons_bar:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "11904705-9797-49EC-865C-B7862F1CAE86", "versionEndIncluding": "4.73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Site Scripting (XSS) autenticado (admin+) almacenado en el plugin Social Media Follow Buttons Bar versiones anteriores o iguales a 4.73 en WordPress"}], "id": "CVE-2021-36839", "lastModified": "2024-11-21T06:14:10.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-30T17:15:11.423", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/social-media-buttons-toolbar/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://wordpress.org/plugins/social-media-buttons-toolbar/"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}